Ransom.Win64.KEVERSEN.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• %System%\cmd.exe /c timeout 1 && del {Malware File Path)\{Malware File Name} >> NUL → deletes itself
• vssadmin.exe delete shadows /all /quiet → deletes shadow copies

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Process Termination

This Ransomware terminates the following services if found on the affected system:

• vmickvpexchange
• vmicguestinterface
• vmicshutdown
• vmicheartbeat
• vmicrdv
• storflt
• vmictimesync
• vmicvss
• MSSQLFDLauncher
• MSSQLSERVER
• SQLSERVERAGENT
• SQLBrowser
• SQLTELEMETRY
• MsDtsServer130
• SSISTELEMETRY130
• SQLWriter
• MSSQL
• SQLAgent
• MSSQLServerADHelper100
• MSSQLServerOLAPService
• MsDtsServer100
• ReportServer
• TMBMServer
• postgresql-x64-9.4
• UniFi
• vmms
• sql-x64-9.4\r\nUniFi\r\nvmms

It terminates the following processes if found running in the affected system's memory:

• sqlserv.exe
• oracle.exe
• ntdbsmgr.exe
• sqlservr.exe
• sqlwriter.exe
• MsDtsSrvr.exe
• msmdsrv.exe
• ReportingServecesService.exe
• fdhost.exe
• fdlauncher.exe
• cher.exe

Information Theft

This Ransomware gathers the following data:

• Computer Name
• Domain Name
• Total RAM
• Number of CPUs
• Number of Disks
• Number of Encrypted Files

Other Details

This Ransomware does the following:

• It deletes itself after encryption using the following command:
  • %System%\cmd.exe /c timeout 1 && del {Malware File Path)\{Malware File Name} >> NUL
• It downloads and executes Tor browser from the following URL:
  • https://dist.{BLOCKED}ject.org/torbrowser/8.5.3/tor-win32-0.3.5.8.zip

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• C:\Windows
• C:\Program files
• C:\Program files (x86)
• C:\System Volume Information
• C:\$Recycle.Bin
• C:\ProgramData
• Data
• C:\Program Files (x86)\Microsoft SQL Server
• C:\Program Files\Microsoft SQL Server
• C:\Program Files(x86)\Intuit
• C:\Program Files(x86)\MYOB

It appends the following extension to the file name of the encrypted files:

• .SunnyDay

It drops the following file(s) as ransom note:

• {Encrypted Folder}\!-Recovery_Instructions-!.txt
  

It avoids encrypting files with the following file extensions:

• .sql
• .mdf
• .txt
• .dbf
• .ckp
• .dacpac
• .db3
• .dtxs
• .mdt
• .sdf
• .MDF
• .DBF
• .DB
• .db
• .ndf
• .NDF
• .Mdf